Lock Picking: Accessing A Locked File

Sometimes it is necessary to see into a file opened by another application in
exclusive mode. FlexHEX lets you do just this. The Open / Locked File
command bypasses the file system, so ignoring system locks and security descriptors.

Hot-tracking is active for locked files as well
as for ordinary read-only files. Note that read/write locked files are also
tracked, not only read-only ones.

Read-Only Access

Accessing a locked file in read-only mode works exactly the same as accessing
an ordinary unlocked file. You probably won't notice much difference at all.
However locked files are being read in unbuffered mode, and operations involving
a lot of reads will take quite a time.

Read/Write Access

Writing into a locked file is tricky and has a lot of quirks. Avoid modifying a locked
file unless you really have to. After all, there is always a good reason why the
file is locked, and forcing the lock may lead to data or system corruption.

Fixed Size

You cannot change the size of a locked file. Changing the file size requires
modification of the correspondent MFT record, and updating a record that is cached
by NTFS will most likely corrupt it.

Resident Files

If the file is very small (say, a hundred bytes or so), NTFS does not allocate disk
space for it. Instead, it keeps the file data in the file's MFT record as a resident
attribute. Overwriting an MFT record will certainly cause a conflict with the file
system, so FlexHEX will not allow saving your changes until the file is increased
and is moved out of the MFT.

Cache conflicts

When you save the changes you made to a locked file, the file system is not
aware the disk data is changed. If the file data reside in the file cache,
the file system will serve read requests from the cache without reading
the actual data. As a result other application will not notice your changes
until the cache is reset.

You can use the Dismount utility to reset
the cache and dismount the drive (it will be mounted automatically on the next
access). However you can't dismount a drive that has open files on it, so this
utility is of limited usefulness.